Meta has been caught failing to abide by Europe’s privacy rules, resulting in the Irish Data Protection Committee slapping the social media giant with a hefty fine.
Facebook’s parent company must pay a 265 million euro ($275 million) penalty and take a number of corrective measures, the Irish DPC said in an announcement on Monday as it concluded a year-and-a-half-long investigation.
The watchdog launched an inquiry into Meta after it discovered a collated dataset of people’s personal Facebook data had been made available on the internet. After closely scrutinizing Facebook Search, Facebook Messenger Contact Importer and Instagram Contact Importer tools, it found that Meta was not living up to its legal obligation to ensure that it was protecting data by design and default.
It falls to Ireland’s privacy watchdog to ensure Meta is following Europe’s General Data Protection Regulation (GDPR), which went into effect in 2018, because like many other Silicon Valley tech giants, Meta has chosen to base its European headquarters in the country. The GDPR gives European internet users some of the strongest privacy protections in the world. If there are security breaches, or if that data is held longer than necessary, companies can get in big trouble.
It’s not the company’s first brush with the law. Back in September 2021, the DPC fined Meta because its messaging service WhatsApp had failed to properly explain to users how it was using their data. There are several other areas of Meta’s historical privacy practices the DPC is also currently probing. But for now, the company has this week’s big fine to contend with.
“Protecting the privacy and security of people’s data is fundamental to how our business works,” said a spokesman for Meta in a statement. He added that the company had complied with the DPC’s investigation and had made changes to the platform in the interim period to prevent scraping of data, including telephone numbers.
“Unauthorized data scraping is unacceptable,” he said, adding that Meta was carefully reviewing the DPC’s decision.
