Meta fined €250 million by Ireland over 2018 data breach.

Photo: AFP

Meta, the parent company of Facebook, WhatsApp, and Instagram, has been fined over €250 million by the Irish Data Protection Commission (DPC) in relation to a significant data breach that occurred in 2018. This breach was reported by Meta in September 2018 and is known to have impacted approximately 29 million Facebook accounts globally. Among these, around three million accounts belonged to users based in the European Union (EU) and the European Economic Area (EEA).

The breach exposed a wide range of sensitive personal data belonging to Facebook users. This included their full names, email addresses, phone numbers, locations, places of work, dates of birth, religions, genders, posts on their timelines, groups they were members of, and even personal information about children. The breach stemmed from the exploitation of user tokens by unauthorized third parties on the Facebook platform. These tokens, which are used to maintain user sessions, were targeted and misused to access user profiles.

Although Meta, along with its US parent company, took immediate steps to remedy the issue after it was discovered, the damage had already been done. The fallout from the breach was extensive, given the volume and sensitivity of the data involved.

The Irish Data Protection Commission, in its investigation and subsequent decision, determined that Meta’s failures warranted substantial penalties. The Commissioners for Data Protection, Dr. Des Hogan and Dale Sunderland, issued multiple reprimands to Meta and imposed administrative fines amounting to €251 million. These decisions were made to underline the serious nature of the breach and the failures in safeguarding user data.

Deputy Commissioner Graham Doyle of the DPC highlighted the gravity of the situation. According to Doyle, the breach posed a severe risk of data misuse and underscored the importance of incorporating robust data protection measures during the design and development of digital platforms. “This case demonstrates how the failure to embed data protection principles throughout the development lifecycle can lead to significant risks and harms for individuals,” Doyle stated.

Stay informed with the latest news. Follow DXB News Network on WhatsApp Channel  

He further elaborated on the potential consequences of the breach, noting that Facebook profiles often contain deeply sensitive personal information. “Profiles can include details about religious or political beliefs, sexual orientation, and other private matters that users may intend to share only in specific contexts. The unauthorized exposure of such information, as seen in this breach, created a grave risk of misuse, threatening individuals’ fundamental rights and freedoms,” Doyle added, as reported by PA Media.

This enforcement action by the DPC underscores the critical need for companies to prioritize data protection and privacy in their operations. The case also serves as a stark reminder of the potential consequences of neglecting these responsibilities, both for organizations and the individuals whose data they are entrusted to protect.