Facebook, Instagram and WhatsApp owner has been fined nearly €1bn by EU since September 2021
The data appeared on a hacking website last year. Photograph: Godofredo A Vásquez/AP
Facebook’s owner has been fined €265m (£230m) by the Irish data watchdog after a breach that resulted in the details of more than 500 million users being published online.
The Data Protection Commission (DPC) said Meta had infringed two articles of the EU’s data protection laws after details of Facebook users from around the world were scraped from public profiles in 2018 and 2019.
The data appeared on a hacking website last year, prompting an investigation by the DPC, which is responsible for regulating Meta across the EU. The watchdog said a “significant” number of the users were from the EU.
In addition to the fine, it “imposed a reprimand and an order” requiring Meta to “bring its processing into compliance by taking a range of specified remedial actions within a particular timeframe”.
In a statement Meta said: “We made changes to our systems during the time in question, including removing the ability to scrape our features in this way using phone numbers. Unauthorised data scraping is unacceptable and against our rules.”
The punishment brings the total amount of fines imposed on Meta by the DPC to nearly €1bn since September last year. In September Meta was fined €405m for letting teenagers set up Instagram accounts that publicly displayed their phone numbers and email addresses, while in March the watchdog fined Meta €17m for further GDPR breaches and in September last year it fined Meta’s WhatsApp €225m over “severe” and “serious” infringements of GDPR.
However, one legal expert questioned whether strong enforcement of the EU’s General Data Protection Regulation would have the deterrent effect that it intended.
“By any measure, these are significant fines,” said David Hackett, head of data protection in the Irland office of law firm Addleshaw Goddard. “GDPR envisaged the imposition of such fines in part to serve as a deterrent to other companies which might consider breaching the law. We are likely to see increased debate about whether such fines actually influence corporate behaviour or if some companies simply see them as an added cost of doing business.”
The DPC regulates Apple, Google, TikTok and other technology platforms owing to the location of their EU headquarters in Ireland. It currently has 40 inquiries open into such companies, including 13 involving Meta.
The Irish regulator said in a statement that other relevant EU regulators agreed with the decision issued on Monday after it shared a draft ruling with them last month under the bloc’s “one-stop shop” system of regulating large multinationals.
From Italy to Sweden, Hungary to France, the far right is once again a force to be reckoned with. Its hostility towards immigrants encourages xenophobes everywhere, including in India. Its social conservatism threatens hard-won LGBTQ+ rights. Its euroscepticism has already upset the dynamics of the EU.
The normalisation of far right rhetoric has gone far enough. For decades, Guardian journalism has challenged populists like this, and the divisions that they sow. Fiercely independent, we are able to confront without holding back because of the interests of shareholders or a billionaire owner. Our journalism is always free from commercial or political influence. Reporting like this is vital for democracy, for fairness and to demand better from the powerful.
And we provide all this for free, for everyone to read. We do this because we believe in information equality. Greater numbers of people can keep track of the events shaping our world, understand their impact on people and communities, and become inspired to take meaningful action. Millions can benefit from open access to quality, truthful news, regardless of their ability to pay for it.
https://www.theguardian.com/technology/2022/nov/28/meta-fined-265m-over-data-breach-affecting-more-than-500m-users
