Facebook parent company fined 265 million euro by Irish data watchdog
Meta has been hit by almost one billion euro in fines by the Data Protection Commission in the past 18 months over EU data breaches.
Your support helps us to tell the story
From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.
At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.
The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.
Your support makes all the difference.Tech giant Meta has been fined 265 million euro by Ireland’s data protection watchdog for breaching EU data privacy laws.
The Data Protection Commission (DPC) issued the sanction against the Facebook parent company for failing to protect millions of Facebook users’ personal data, such as telephone numbers and email addresses, from being “scraped” and published on the internet.
In a statement on Monday the DPC said Meta had been fined for “infringement” of sections of the EU’s GDPR rules that cover technical and organisational measures aimed at protecting user data.
It brings the total fines issued against by Meta in the past 18 months to more than 900 million euro.
The latest investigation by the DPC into Meta began in April last year “on foot of media reports into the discovery of a collated dataset of Facebook personal data that had been made available on the internet”.
The data, which was found on a website for hackers, included names, phone numbers, locations, birthdates and email addresses of Facebook users.
Meta said the data had been “scraped” from Facebook.
In a statement Meta said: “We made changes to our systems during the time in question, including removing the ability to scrape our features in this way using phone numbers.
“Unauthorised data scraping is unacceptable and against our rules.”
The DPC said: “The scope of the inquiry concerned an examination and assessment of Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer tools in relation to processing carried out by Meta Platforms Ireland Limited (MPIL) during the period between 25 May 2018 and September 2019.
“The material issues in this inquiry concerned questions of compliance with the GDPR obligation for Data Protection by Design and Default.
“The DPC examined the implementation of technical and organisational measures pursuant to Article 25 GDPR (which deals with this concept).”
The DPC said after a “comprehensive inquiry process” that it had “recorded findings of infringement of Articles 25(1) and 25(2) GDPR”.
It ordered Meta to take remedial action to ensure “scraping” does not happen again.
“The decision imposed a reprimand and an order requiring MPIL to bring its processing into compliance by taking a range of specified remedial actions within a particular timeframe,” a statement from DPC said.
“In addition, the decision has imposed administrative fines totalling 265 million euro on MPIL.”
The fine was agreed with other EU data regulators.
There have been increasing calls to better resource Ireland’s DPC, which is the de facto lead EU watchdog of data protection and privacy rules due to a large number of tech multinationals – including Facebook, Apple and Google – basing their European headquarters in Dublin.
In July, the Irish Government announced that two additional data protection commissioners would be hired, and that the current commissioner, Helen Dixon, would be promoted to chairwoman of the DPC.
It said that this was being done in response to “the increased working burden and investigative complexity has been regularly highlighted”.
The Irish watchdog issued a 405 million euro fine to Meta-owned Instagram in September over the way in which it handled teenagers’ personal data, making it the largest fine the authority has ever issued.
Instagram said it would appeal against the decision.
In March the regulator also issued a fine of 17 million euro against Facebook for breaching EU privacy laws.
Last year Meta-owned messaging service WhatsApp was hit with a fine of 225 million euro by the DPC for breaching European Union laws on transparency, and the sharing of user information with other companies owned by Facebook.