On 27th September 2024, the Irish Data Protection Commission (DPC) issued a €91 million fine to Meta Platforms Ireland Limited following an inquiry into a 2019 data breach.
The breach occurred when Meta accidentally stored certain users’ passwords in plaintext, without proper cryptographic protection or encryption, on its internal systems.
Details of the 2019 Data Breach
The breach, which was reported by Meta in March 2019, involved sensitive data, including social media account passwords.
While the passwords were not exposed to external parties, the breach raised serious concerns about the security of user information.
GDPR Violations and the Resulting Fine
The DPC found multiple violations of GDPR, including failures to notify the DPC of the breach, inadequate documentation, and insufficient security measures to protect user data.
Meta was fined for violating GDPR provisions related to:
- Timely breach notification (Article 33(1)),
- Documentation of breach details (Article 33(5)), ensuring data security (Article 5(1)(f)),
- And implementing appropriate security measures for personal data (Article 32(1)).
Deputy Commissioner Graham Doyle emphasized the risks associated with storing passwords in plaintext, noting the potential for misuse if such data were accessed.
The fine reflects the DPC’s commitment to holding companies accountable for inadequate data protection practices. The full decision and further information will be published by the DPC in due course.
