Yes. In order to be able to provide the Workplace service, it is essential for us to be able to transfer data outside of the EEA and to utilise our global infrastructure. We do this in accordance with our Workplace Online Terms and specifically, the European Data Transfer Addendum. Workplace customer data processed by Meta Ireland will be transferred to countries outside the EEA, including the United States, for the purposes described in our Workplace Online Terms. These data transfers are necessary to operate and provide the Workplace service.

From 7 September 2023, Meta will rely on the new Data Privacy Framework (DPF) for the transfer of Workplace customer data from the EU to the US. The DPF resolves a long-standing conflict of law between the EU and US, and means that we have the legal clarity to continue providing our services in Europe for the foreseeable future.

The DPF came into effect earlier this summer after the European Commission adopted its adequacy decision. It is a robust agreement that ensures the continued protection of Europeans’ data and renews legal safeguards for thousands of transatlantic companies that transfer data between Europe and the US. It ensures that vital digital connections between businesses on both sides of the Atlantic can continue uninterrupted.

We have in place a number of safeguards and measures for Workplace data being transferred outside the EEA, including:

Security:

Meta maintains an Information Security Management System (ISMS) for Workplace. ISMS is put in place to establish, maintain and continuously improve the confidentiality, integrity, and availability of Workplace information assets and to ensure the trust of users using the Workplace platform. This has allowed Meta to maintain both ISO27001 and ISO27018 for Workplace, in addition to maintaining a SOC2 report and the robust technical safeguards outlined in the Data Security Addendum of the Workplace Online Terms. Becoming ISO27001 and ISO27018 compliant demonstrates Workplace is committed to protecting its operations and information from internal and external threats.

Encryption of data in transit so it cannot be read:

Meta employs industry standard encryption algorithms and protocols designed to secure and maintain the confidentiality of data in transit over public networks. Employing advanced encryption algorithms enables Meta to secure Workplace data in transit from access by third parties.

Operational policies and procedures:

We have robust policies and procedures in place to ensure Workplace data is adequately protected in relation to requests from governmental agencies. For example, we will only comply with a governmental request for Workplace user data after we are satisfied that the request complies with applicable law and our policies. If the request is unlawful (e.g. overly broad, or legally deficient in any way), we will push back or challenge the request. We encourage governmental agencies to submit only requests that are necessary, proportionate, specific, and strictly compliant with applicable laws, by publishing guidelines for government requests. More details about how we respond to government requests are provided in the Reviewing Government Requests FAQ.

No “back door” governmental access: We do not provide any government with direct access or encryption “back doors.” We believe that intentionally weakening our services in this way would undermine the security that is necessary to protect people who use our global service.

Oversight:

We have a dedicated, trained Law Enforcement Response Team (LERT) that reviews and evaluates every government request for user data individually, whether the request was submitted related to an emergency or through legal process obtained by law enforcement or national security authorities. This team ensures that all requests are consistent with applicable law and our policies.

Meta’s Transparency Report:

We publish information on government requests we receive in our Transparency Report. Information regarding requests made under the US Foreign Intelligence Surveillance Act (FISA) is included in the report with the maximum level of detail permitted under US law.

Advocacy:

We appreciate the focus of governments across the globe on protecting and safeguarding people’s data, including in the US and Europe, and we work hard to do our part. We actively engage with governments to encourage practices that protect peoples’ rights. We belong to advocacy groups like Global Network Initiative, whose mission is to advance the freedom of expression and privacy rights of Internet users worldwide; and are a founding member of Reform Government Surveillance, which advocates for government data requests to be rule-bound, narrowly tailored, transparent, subject to strong oversight and protective of end-to-end encryption. We support surveillance reform and frequently engage with various government and regulatory bodies to advocate the same.

Individual rights:

In addition to the rights under EU law and US law, individuals also have the right to submit a complaint or questions about Meta’s DPF certification through TRUSTe, an alternative dispute resolution provider based in the United States.

Metas policy is to redirect government requesters to the Workplace customer in the first instance. If Meta is required to respond to a request for information relating to Workplace customer data, then this Government Requests FAQ sets out the policy and processes which will apply.

Meta scrutinizes every government request we receive, regardless of which government makes the request, to make sure it is legally valid. If we determine that a government request is not consistent with applicable law or our policies, we push back and engage the governmental agency to address any apparent deficiencies. If the request is unlawful (e.g. overly broad, or legally deficient in any way), we will challenge or reject the request. We encourage governmental entities to submit only requests that are necessary, proportionate, specific, and strictly compliant with applicable laws, by publishing guidelines for government requests.

We have robust policies to ensure every government request is scrutinized no matter which government makes the request. Meta must comply with valid and compulsory legal requests from US government agencies. These requests must be made in accordance with applicable law and our policies, and we produce only the information that is narrowly tailored to respond to each request.