Meta Fined $263 Million for GDPR Breaches in 2018 Facebook Data Leak

Day

–:–

Post Activated

Meta Platforms, the parent company of Facebook, has been hit with a €251 million ($263 million) fine by Ireland’s Data Protection Commission (DPC) for violations of the General Data Protection Regulation (GDPR) related to a massive data breach in 2018. The breach exposed sensitive information from approximately 29 million Facebook user accounts worldwide.

The DPC’s investigation revealed that Meta’s video upload system failed to adequately protect user data, leading to the exposure of profile information. The compromised data included users’ locations, religion, gender, posts, group memberships, phone numbers, email addresses, and even children’s personal data, according to the DPC’s findings.

A Major GDPR Enforcement

“This enforcement action highlights how the failure to build in data protection requirements throughout the design and development cycle can expose individuals to very serious risks and harms,” stated Graham Doyle, DPC Deputy Commissioner. He emphasized that the breach posed significant risks of data misuse due to the vulnerabilities in Meta’s systems.

Meta disclosed the breach to the DPC in September 2018 and stated that the company took immediate action to address the vulnerability. However, the fine reflects the DPC’s conclusion that Meta’s actions were insufficient and did not fully comply with GDPR requirements.

Meta’s Response

A Meta spokesperson responded to the fine by pointing out that the incident occurred six years ago and emphasizing that the company acted swiftly to mitigate the damage.

“We took immediate action to fix the problem as soon as it was identified, and we proactively informed people impacted as well as the Irish Data Protection Commission,” the spokesperson said. “We have a wide range of industry-leading measures in place to protect people across our platforms.”

Despite this, the DPC cited several factors contributing to the fine, including Meta’s alleged failure to provide all required information in its original breach notification and inadequate documentation of its response to the breach. Furthermore, Meta was found to have failed in implementing appropriate data protection methods during the design and development of its systems, a critical GDPR requirement.

Recurring GDPR Violations

This fine is just one in a series of penalties Meta has faced for GDPR violations in recent years. The DPC has been particularly active in regulating Meta, as the company’s European operations are based in Dublin.

Here is a breakdown of some of Meta’s other significant fines under GDPR enforcement:

September 2024: €91 million ($96 million) for inadequately safeguarding users’ passwords and delaying reporting the issue.
May 2023: €1.2 billion ($1.3 billion) for transferring Facebook users’ data from the EU to the U.S.
September 2021: €405 million ($425 million) for mishandling minors’ data.
January 2023: €390 million ($410 million) for improper ad-targeting data processing.

Implications for Data Protection

The DPC’s latest fine underscores the importance of integrating robust data protection measures into every stage of system design. GDPR, one of the world’s most stringent data privacy laws, requires companies to minimize the collection and processing of personal data and to document compliance efforts meticulously. Meta’s repeated violations suggest systemic shortcomings in meeting these obligations.

While Meta has claimed to implement industry-leading protections, the frequency and scale of these fines raise questions about its commitment to data privacy and security. For users and regulators alike, the case serves as a reminder of the ongoing challenges in holding tech giants accountable for safeguarding personal data.

What’s Next for Meta?

As GDPR enforcement continues to tighten, Meta will likely face increased scrutiny and regulatory pressure, particularly in Europe. The company’s handling of data and compliance processes will remain under the spotlight as privacy advocates and regulators push for stronger accountability in the tech industry.

This €251 million fine serves as a significant financial and reputational hit for Meta, but it also highlights the broader need for stricter adherence to data protection principles across the technology sector.