Meta Platforms Ireland Limited (MPIL), a subsidiary of global tech giant Meta, has been fined €251 million by the Irish Data Protection Commission (DPC) for a data breach that exposed sensitive personal information of 29 million Facebook users in 2018.
The breach, which Meta reported in September 2018, exploited vulnerabilities in Facebook’s “View As” feature—a tool allowing users to preview their profiles as others see them. Attackers used automated scripts to manipulate user tokens, granting unauthorized access to accounts and exposing details such as full names, email addresses, phone numbers, locations, workplaces, dates of birth, religious affiliations, and posts. Notably, children’s data was also compromised.
Although Meta resolved the issue quickly, the DPC’s investigation revealed significant lapses in how the company handled and documented the incident under the EU’s General Data Protection Regulation (GDPR).
The DPC identified multiple GDPR violations, resulting in substantial fines. Meta failed to provide sufficient details in its breach notification as required by GDPR Article 33(3), incurring an €8 million fine. Additionally, inadequate documentation of the incident led to a further €3 million penalty. Meta was also found to have neglected data protection principles during system design, in breach of GDPR Articles 25(1) and 25(2), resulting in fines of €130 million and €110 million, respectively.
Graham Doyle, deputy commissioner of the DPC, emphasized the risks posed by such breaches, noting that sensitive information in Facebook profiles—such as political views, religious beliefs, and sexual orientation—could be misused, compromising individuals’ privacy and safety.
This penalty is the latest in a series of fines against Meta under the GDPR. Since the regulation came into effect in 2018, Meta has faced nearly €3 billion in penalties, including a record €1.2 billion fine in 2023. The company plans to appeal the latest ruling.
The DPC’s enforcement highlights Europe’s robust stance on data privacy, but similar regulatory scrutiny is increasing in other regions.
In July 2024, Nigeria’s Federal Competition and Consumer Protection Commission (FCCPC) and Nigeria Data Protection Commission (NDPC) jointly fined Meta $220 million for privacy violations and abuse of market dominance. The Nigerian authorities accused the company of unauthorized data transfers, cross-border storage without compliance, and discriminatory practices.
The fines underscore a global push for accountability in data protection, with regulators worldwide intensifying their focus on tech giants like Meta. As data breaches continue to pose risks to personal privacy and safety, regulators are expected to impose stricter enforcement and penalties, further challenging tech companies to prioritize compliance.
